💷Billing & invoicing
Recurring billing that gets the details right.
- Renewal invoices created days ahead (you choose how many), one invoice per client, with due dates that only ever move forward.
- Two-level tax rules by country and state, tax-exempt clients, credit balances, partial payments, refunds and printable
PDF invoices.
- Branded PDF invoices and quotes with your company name, in a dark panel style or a printer-friendly light style, attached to invoice, reminder, payment and quote emails automatically.
- Multi-currency pricing per product and billing cycle, with each client billed in their own currency. UK defaults:
GBP, Europe/London.
- Quotes for clients or prospects: line discounts, PDF, a private link to accept or decline, and one click to turn an accepted quote into an invoice.
🏛️KarnakPanel server module — included
Full account automation for your KarnakPanel servers, out of the box.
- Create hosting accounts automatically when an order is accepted or paid, on the package you choose, with the order's domain added.
- Suspend and unsuspend automatically with smart dunning when invoices go overdue and get paid.
- Free usernames picked for you: at checkout HostBMS checks the panel and reserves a valid username that isn't already taken, so account creation doesn't fail later.
- Delete (terminate) accounts and change passwords, from the admin area or on your dunning schedule.
- Optional client self-service from the service page: domains and free SSL, DNS records, mailboxes and forwarders, MySQL databases, backups and rewrite rules — switched on per product.
- Talks to the KarnakPanel API over verified HTTPS with an admin token; account creation runs in the background so checkout never waits. About KarnakPanel →
🔁Smart dunning
Collect more, annoy less.
- Your own schedule of reminder, card retry, late fee, suspend, terminate and collections steps, measured in days from the due date.
- Hard declines (lost, stolen, expired cards) stop further retries straight away; soft declines retry on schedule.
- After downtime it catches up within a window you set, and skips steps that a later one supersedes — no burst of five emails at once.
- Pause dunning per client, exempt clients from late fees, and see every step taken on every invoice, plus a recovery report.
💳Payments
Hosted checkouts — card numbers never touch your server.
- Stripe Hosted Checkout and Mollie (cards, PayPal, iDEAL, Klarna and whatever your Mollie profile enables), plus PayPal Checkout and bank transfer.
- A "Ways to pay" strip on the storefront shows the logos of the payment methods you have switched on.
- Saved cards and Mollie mandates charge renewals and dunning retries automatically; refunds go back through the gateway.
- Payments are recorded only from data fetched from the provider, with signed webhooks, idempotency keys and duplicate protection.
- Gateway modules use the WHMCS convention (
_config, _link, _capture, _refund).
🛒Products, orders & order forms
Sell plans the way you want them shown.
- Product groups, billing cycles from monthly to triennial, setup fees, configurable options, addons, stock control and promo codes.
- Orders with pending/accept/cancel/fraud flow, automatic setup on order or on payment, and a fraud-check module slot.
- Visual order-form builder: card, list or comparison layouts, featured plans with badges, upsells and drag-and-drop ordering.
- A/B test two layouts per product group and compare daily views and orders.
🖥️Provisioning & domains
WHMCS-style modules, so you are not starting from zero.
- Server modules: create, suspend, unsuspend, terminate, change password and package, plus custom admin and client buttons. Servers picked automatically by group.
- Registrar modules: register, transfer, renew, nameservers, lock and EPP codes, with daily sync and grace / redemption periods per TLD.
- Compatibility layer:
add_hook, localAPI, logModuleCall, WHMCS\Database\Capsule and read-only tbl* views for module queries.
- Every module call is logged; failures leave the service pending and visible instead of half-created.
🎧Support desk
Tickets, knowledgebase and news, in the same app.
- Departments, statuses, assignment, predefined replies and private staff notes that clients never see.
- Email piping: replies thread onto the right ticket, new emails open tickets by department address, bounces are ignored.
- Guest tickets with private links, safe attachments (scripts and HTML always refused), and auto-close of quiet tickets.
- Knowledgebase with voting, and announcements on the client area home page.
💬Live chat
Self-hosted, off until you switch it on.
- A chat widget on your client area that offers "Would you like help?" only while staff are online — no outside chat service or script.
- Visitors pick a department; staff choose which departments they take, with sound and desktop alerts and a waiting-chats count in the admin menu.
- Typing indicators both ways, saved replies, and optional file sharing for staff and logged-in clients (guests never send files; scripts and web pages are always refused).
- Guests go through the same invisible spam checks as signups, with per-network limits and blocks; save any chat as a support ticket.
👥Client area
The "Nebula" theme: dark, glassy and easy to use.
- Services, domains, invoices, quotes, tickets, email history and account details, with a store and cart.
- Sub-accounts with their own logins and permissions (billing, support, services, emails…).
- Password reset with single-use, expiring tokens; client logins kept separate from staff logins.
- Optional UK postcode address finder on signup and account forms: enter a postcode and house number, pick the address (needs an Ideal Postcodes key).
⚙️Automation, email & reports
One cron line does the rest.
- Cron runs invoicing, dunning, domain sync and ticket auto-close; a background job queue retries failed work with back-off.
- Branded HTML emails in the panel's dark blue style with button links and a plain-text version; editable templates for every event, a full email log, and delivery via PHP mail or SMTP.
- Reports for income, invoices, MRR by product, top clients, dunning recovery and more — with CSV export.
🛡️Security
Built in, not bolted on.
- Staff two-factor authentication (TOTP), role-based permissions and login lockouts per user and per IP.
- An audit log of every staff and API change, CSRF protection on every form, and secrets encrypted at rest (AES-256-GCM).
- API credentials tied to a staff role, with optional IP allow-lists and rate limits.
- Security scanned with Semgrep. Every release's PHP and JavaScript is checked with the open-source Semgrep scanner (PHP, JavaScript, security-audit, OWASP Top 10 and secrets rule packs) before it's published. v0.2.5 (28 Oct 2026): 464 files, 0 open findings. The scan doesn't cover third-party libraries or server setup, and no scan proves code is bug-free;
SECURITY.md in the download has the details and how to report a vulnerability.
- Built-in spam protection for signups and guest tickets, with no outside service: a question, an invisible browser check (proof of work), email-domain and throwaway-inbox checks, link limits and blocked words.
🚚Install & migrate
From upload to first invoice in one sitting.
- Web installer with requirement checks: upload, open
/install/, follow the steps.
- One-click updates from Setup › Updates: releases are signed and verified, files and database are backed up first, and a failed update rolls itself back.
- WHMCS migrator: clients, contacts, products and pricing, services, domains, invoices, transactions and tickets, keeping WHMCS IDs, from the installer or the admin area. Always a dry run first.
- A REST API with WHMCS action names (
GetClients, CreateInvoice, AddInvoicePayment…) so existing scripts can point at HostBMS.
🧪
Want to try it?
HostBMS is in early development. Testers get early builds and a direct line to us.